← All detection heuristics · Polyglot
critical
IMAGE_TRAILING_OVERLAY_EXECUTABLE
What it means
A valid image is followed by a large appended overlay that is a second container (PE/ZIP/...) or a loader-delimited base64-encoded payload.
Why it fires
Image-stego-loaders ship a real lure image (often a 4K screenshot) with an encoded or raw payload appended after the image's logical end (JPEG EOI / PNG IEND / GIF trailer). The image renders normally while a loader (AutoIt/.NET, AsyncRAT/njRAT/DCRat family) extracts and runs the hidden PE. Benign images carry at most a few KB of structured slack, never a large executable/archive or a delimiter-marked base64 blob, so this overlay shape has no benign use.
Other Polyglot heuristics
JPEG_CARRIER_EMBEDDED_ENCODED_PE POLYGLOT_CHILD_PDF_STATIC_TRIAGE